CyberSecurity Updates

05 Sep

GhostRedirector poisons Windows servers: Backdoors with a side of Potatoes

Information

ESET researchers have identified a new threat actor, whom we have named GhostRedirector, that compromised at least 65 Windows servers mainly in Brazil, Thailand, and Vietnam. GhostRedirector used two previously undocumented, custom tools: a passive C++ backdoor that we named Rungan, and a malicious Internet Information Services (IIS) module that we named Gamshen. While Rungan has the capability of executing commands on a compromised server, the purpose of Gamshen is to provide SEO fraud as-a-service,…

Read More
03 Sep

CISA, NSA, and Global Partners Release a Shared Vision of Software Bill of Materials (SBOM) Guidance

Attacks, Insights, Malware

CISA, in collaboration with NSA and 19 international partners, released joint guidance outlining A Shared Vision of Software Bill of Materials (SBOM) for Cybersecurity. This marks a significant step forward in strengthening software supply chain transparency and security worldwide. An SBOM is a formal record detailing the components and supply chain relationships used in building software. SBOMs act as a software “ingredients list” providing organizations with essential visibility into software dependencies, enabling them to identify…

Read More
01 Sep

The Ongoing Fallout from a Breach at AI Chatbot Maker Salesloft

Data Breaches, Information, Insights

The recent mass-theft of authentication tokens from Salesloft, whose AI chatbot is used by a broad swath of corporate America to convert customer interaction into Salesforce leads, has left many companies racing to invalidate the stolen credentials before hackers can exploit them. Now Google warns the breach goes far beyond access to Salesforce data, noting the hackers responsible also stole valid authentication tokens for hundreds of online services that customers can integrate with Salesloft, including…

Read More
29 Aug

This month in security with Tony Anscombe – August 2025 edition

Information

From Meta shutting down millions of WhatsApp accounts linked to scam centers all the way to attacks at water facilities in Europe, August 2025 saw no shortage of impactful cybersecurity news 28 Aug 2025 As August 2025 comes to a close, ESET Chief Security Evangelist Tony Anscombe reviews a selection of the top cybersecurity stories that moved the needle, raised the alarms or offered vital lessons over the past 30 or so days, as well…

Read More
29 Aug

Nevada Confirms Ransomware Attack Behind Statewide Service Disruptions

Information, News

Nevada on Wednesday confirmed that the days-long disruption to state systems and services was caused by a ransomware attack. The incident, disclosed on Monday morning as a network security incident, occurred on Sunday, and forced Nevada to close all state offices on Monday and Tuesday. During a press conference on Wednesday, the state’s officials publicly confirmed that a “sophisticated ransomware attack” was the cause of the disruptions. “Upon detection, we immediately activated our established cybersecurity…

Read More
28 Aug

Affiliates Flock to ‘Soulless’ Scam Gambling Machine

Information, Insights

Last month, KrebsOnSecurity tracked the sudden emergence of hundreds of polished online gaming and wagering websites that lure people with free credits and eventually abscond with any cryptocurrency funds deposited by players. We’ve since learned that these scam gambling sites have proliferated thanks to a new Russian affiliate program called “Gambler Panel” that bills itself as a “soulless project that is made for profit.” A machine-translated version of Gambler Panel’s affiliate website. The scam begins…

Read More
28 Aug

First known AI-powered ransomware uncovered by ESET Research

Information

ESET Research The discovery of PromptLock shows how malicious use of AI models could supercharge ransomware and other threats 26 Aug 2025  •  , 2 min. read ESET researchers have discovered what they called “the first known AI-powered ransomware”. The malware, which ESET has named PromptLock, has the ability to exfiltrate, encrypt and possibly even destroy data, though this last functionality appears not to have been implemented in the malware yet. While PromptLock was not…

Read More
28 Aug

Don’t let “back to school” become “back to (cyber)bullying”

Information

Kids Online Cyberbullying is a fact of life in our digital-centric society, but there are ways to push back Phil Muncaster 27 Aug 2025  •  , 4 min. read For better or worse, the digital world in many ways resembles its physical counterpart. Unfortunately, that means it sometimes enables, and even exacerbates, the same bad behaviors that we often see offline. According to a 2023 Microsoft study covering 17 countries, “cyberbullying harassment and abuse” is…

Read More
27 Aug

CISA and Partners Release Joint Advisory on Countering Chinese State-Sponsored Actors Compromise of Networks Worldwide to Feed Global Espionage Systems

Attacks, Insights, Malware

CISA, along with the National Security Agency, Federal Bureau of Investigation, and international partners, released a joint Cybersecurity Advisory on People’s Republic of China (PRC) state-sponsored Advanced Persistent Threat (APT) actors targeting critical infrastructure across sectors and continents to maintain persistent, long-term access to networks. This advisory builds on previous reporting and is based on real-world investigations conducted across multiple countries through July 2025. While the activity observed overlaps with industry reporting on the group known as Salt Typhoon,…

Read More
26 Aug

DSLRoot, Proxies, and the Threat of ‘Legal Botnets’

Information, Insights

The cybersecurity community on Reddit responded in disbelief this month when a self-described Air National Guard member with top secret security clearance began questioning the arrangement they’d made with company called DSLRoot, which was paying $250 a month to plug a pair of laptops into the Redditor’s high-speed Internet connection in the United States. This post examines the history and provenance of DSLRoot, one of the oldest “residential proxy” networks with origins in Russia and…

Read More